US Feds seize 33 Iranian news site domains

The US government said it has seized control of 33 domain names previously belonging to an Iranian TV news station that the US considers linked to terrorism.

The Department of Justice said the domains had been registered by the Iranian Islamic Radio and Television Union, which it said is controlled by Islamic Revolutionary Guard Corps Quds Force, designated as a terrorist organization.

Among the domains is presstv.com, used by Press TV, an Iranian state-owned station that broadcasts news in English and French.

The DoJ said the sites were “disguised as news organizations or media outlets” and “targeted the United States with disinformation campaigns and malign influence operations”.

All of the seized names reportedly use .com, .net and .tv domains, which are all operated by Verisign.

The DoJ obtained a court order to grab the names.

As an overseas registrar was used to register the names, it appears the court order instructed Verisign, based in the US, to hand them over.

The domains now direct to a US government placeholder informing visitors of the seizure. Some of the affected web sites have reportedly started using new domains.

Under US law, “Specially Designated Nationals” listed by the Office of Foreign Assets Control are forbidden from obtaining services from US companies without a special license.

The DoJ said it has seized an additional three domains owned by Kata’ib Hizballah (Kataib Hezbollah), an Iraqi militia backed by Iran.

US officials gunning for coronavirus domains

US state and federal law enforcement are pursuing domain names being used to push bogus products and misinformation related to coronavirus Covid-19.
In separate actions, the US Department of Justice forced Namecheap to take down a scam site that was allegedly using fear of coronivirus to hoodwink visitors out of their cash, while the New York Attorney General has written to registrars to demand they take action against similar domains.
The DoJ filed suit (pdf) against the anonymous “John Doe” registrant of coronavirusmedicalkit.com on Saturday and on Sunday obtained a temporary restraining order obliging Namecheap to remove the DNS from the domain and lock it down, which Namecheap seems to have done.
Namecheap is not named as a defendant, but the complaint notes that the DoJ had requested the domain be taken down on March 19 and no action had been taken by the evening of March 21.
The web site in question allegedly informed visitors that the World Health Organization was giving away free coronavirus vaccines to anyone prepared to pay a $4.95 shipping fee by handing over their credit card details.
This is an identity theft scam and wire fraud, the complaint says.
Meanwhile, NYAG Letitia James has sent letters, signed by IT chief Kim Berger, to several large US registrar groups — including GoDaddy, Dynadot, Name.com, Namecheap, Register.com, and Endurance — to ask them to “stop the registration and use of internet domain names by individuals trying to unlawfully and fraudulently profit off consumers’ fears around the coronavirus disease”.
In the letter to GoDaddy (pdf), Berger asks for a “dialogue” on the following preventative measures:

• The use of automated and human review of domain name registration and traffic patterns to identify fraud;
• Human review of complaints from the public and law enforcement about fraudulent or illegal use of coronavirus domains, including creating special channels for such complaints;
• Revising your terms of service to reserve aggressive enforcement for the illegal use of coronavirus domains; and
• De-registration of the domains cited in the articles identified above that were registered at GoDaddy, and any holds in place on registering new domains related to coronavirus, or similar blockers that prevent rapid registration of coronavirus-related domains.

In other words: try to stop these domains being registered, and take them down if they are.
No specific malicious sites are listed in the letter. Rather, Berger cites a study by Check Point Software that estimates that something like 3% of the more than 4,000 coronavirus-related domains registered between January and March 5 are “malicious” in nature.

.web closer to reality as antitrust probe ends

Verisign has been given the all-clear by the US government to go ahead and run the new gTLD .web, despite competition concerns.
The Department of Justice told the company yesterday that the antitrust investigation it launched almost exactly a year ago is now “closed”.
Verisign’s secret proxy in the 2016 auction, the original .web applicant Nu Dot Co, now plans to try to execute its Registry Agreement with ICANN.
That contract would then be assigned to Verisign through the normal ICANN process.
The .com registry operator today filed this statement with the US Securities and Exchange Commission:

As the Company previously disclosed, on January 18, 2017, the Company received a Civil Investigative Demand from the Antitrust Division of the United States Department of Justice (“DOJ”) requesting certain material related to the Company becoming the registry operator for the .web gTLD. On January 9, 2018, the DOJ notified the Company that this investigation was closed. Verisign previously announced on August 1, 2016, that it had provided funds for Nu Dot Co’s successful bid for the .web gTLD and the Company anticipates that Nu Dot Co will now seek to execute the .web Registry Agreement with ICANN and thereafter assign it to Verisign upon consent from ICANN.

This basically means that Justice disagrees with anyone who thinks Verisign plans to operate .web in a way that just props up its .com market dominance, such as by burying it without a trace.
People clamoring to register .web domains may still have some time to wait, however.
Rival applicant Donuts, via subsidiary Ruby Glen, still has a pending lawsuit against ICANN in California.
Donuts had originally sued to prevent the .web auction going ahead in mid-2016, trying to force Nu Dot Co to reveal who was really pulling its strings.
After the auction, in which Verisign committed to pay ICANN a record-setting $125 million, Donuts sued to have the result overturned.
But in November 2016, a judge ruled that the no-suing covenant that all new gTLD applicants had to sign was valid, throwing out Donuts’ case.
Donuts is now appealing that ruling, however, filing its most-recent brief just a few weeks ago.
Whether that will stop ICANN from signing the .web contract and delegating it to Verisign is an open question. It managed to delegate .africa to ZA Central Registry despite the existence of an ongoing lawsuit by a competing applicant.
If history is any guide, we may see a rival applicant apply for a temporary restraining order against .web’s delegation before long.

Justice gives nod to O.com auction

The US Department of Justice does not intend to prevent Verisign from auctioning off the single-letter domain o.com.
Aaron Hoag, chief of the department’s Technology & Financial Services Section, told ICANN in a letter (pdf) that it does not intend to probe Verisign’s proposal.
The letter reads in its entirety:

Your letter dated December 7, 2017, to Makan Delrahim, Assistant Attorney General of the Antitrust Division, regarding VeriSign’s proposal to auction O.COM, has been referred to the Technology & Financial Services Section for review. After careful consideration of the matter, the Division can report that it does not intend to open an investigation into the proposed auction described in the attachment to your letter.

Verisign asked ICANN’s permission to auction o.com, with most of the the proceeds going to good causes, after over a decade of nagging from retailer Overstock.com, which desperately wants to own the currently reserved name.
It would set a precedent for the company to sell off the remaining 22 single-letter domains, not to mention the 10 digits, which are all currently reserved due to a decades-old technical policy no longer considered necessary.
Verisign would only receive its $7.85 base registry fee from the sale, despite the fact that single-letter domains could easily fetch seven or eight figures.
The company asked ICANN for permission to release the name via its Registry Services Evaluation Process last month.
ICANN said earlier this month that it had no objection on technical grounds, but referred it to US competition authorities for a review.
With the DoJ apparently not interested, the door is open for ICANN to approve the RSEP before the end of the year, meaning Verisign could carry out the auction in 2018.
The big question now is whether anyone other than Overstock will want to take part in the auction. Overstock has US trademarks on “O.com”, despite the fact that it’s never actually owned the domain.

Antitrust feds probing Verisign’s .web deal

US antitrust authorities are investigating Verisign over its anticipated operation of the .web gTLD.
The probe was disclosed by company CEO Jim Bidzos in yesterday’s fourth-quarter earnings call. He said:

On January 18, 2017, the company received a Civil Investigative Demand from the Antitrust Division of the US Department of Justice, requesting certain information related to Verisign’s potential operations of the .web TLD. The CID is not directed at Verisign’s existing registry agreements.

He did not comment further, beyond describing it as “kind of like a subpoena”.
Verisign acquired the rights to run .web at an ICANN last-resort auction last July, agreeing to pay $135 million.
Rather than applying for the gTLD itself, it secretly bankrolled shell company Nu Dot Co, which intends to transfer its .web contract to Verisign after it is signed.
ICANN is being sued by rival applicant Donuts, which claims NDC should have been banned from the auction. Afilias, the auction runner up, is also challenging the outcome.
But this new DoJ investigation, if we take Bidzos’ words at face value, appears to focus on what Verisign plans to do with .web once it is live.
It’s the view of many that .web would be the new gTLD best positioned as an alternative to .com, which makes Verisign hundreds of millions of dollars a year.
It’s my view that it would make perfect sense for Verisign to flush the $135 million and bury .web, rather than have a viable competitor on the market.
Verisign has repeatedly said that intends to “grow and widely distribute .web”, words Bidzos repeated last night.
The investigation is likely into whether Verisign wants to actually raise .web, or strangle it in its crib.
It seems the investigation was launched in the dying days of the Obama administration, so the recent changing of the guard at Justice — Attorney General Jeff Sessions was confirmed by Congress just two days ago — may have an impact on how it plays out.